Application Center appsettings

This page lists all available appsettings.json settings for the Application Center (Core).

The appsettings.json file is located in the <AMT Environment>\AmtTools\ApplicationCenterCore\ folder.

The appsettings file is divided into the following sections.

HideMenu

With this setting set to true, the Application Center will start with the left menu hidden. The default value is false.

"HideMenu": false,

ShowLogOff

When this setting is added and set to false, the Log off link in the Application Center will not be shown. The default value is true.

"ShowLogOff": true,

LogOffBehavior

This setting is explained in Session Logout Behaviour.

Theme

This setting is explained in AMT Web Themes.

Culture

The language of the Application Center, used for localization. See Localization.

"Culture": "ENGLISH",

KeepAliveInterval

The number of minutes between keepalive calls originating from a JavaScript script in the browser. It is important that this interval is shorter or equal to the lifetime of the authentication tokens and the web session timeout.

"KeepAliveInterval": 5,

AmtCookieEncryptionKey

This setting is explained in Generating Keys.

BusinessLogic

Settings needed to communicate with the Application Center WebAPI.

• Address - The URL of the ApplicationCenterBL website should be set as the value of this key.
• RequestTimeout - The timeout (in minutes) for requests to the business logic address. This default value is approximately 1 minute and 40 seconds (1.67 minutes).

"BusinessLogic": {
  "Address": "https://<domain>[:port]/<path>",
  "RequestTimeout": 1.67
},

AuthenticationType

The authentication type used to log into the Application Center, the only valid option is "OIDC" (OpenID Connect).

"AuthenticationType": "OIDC",

OIDC

This section holds the settings for OpenID Connect authentication.

• ClientId - The client ID of the application.
• Authority - The OIDC authority URL.
• Scope - The scopes to request from the authorization server to allow access tokens to be used to call other resource servers (e.g. CC, AC or Blazor APIs).
• ClientSecret - The client secret of the application, not applicable if client assertion is enabled.
• TokenValidationParameters:
  • NameClaimType - The claim type that will be used to identify the user. Commonly preferred_username is used as claim type.
    The claim type must be identical to the claim type set in the ApplicationCenterBL appsettings.
• RequireHttpsMetadata - If true then HTTPS is required for the authority. The default is true. This should be disabled only in development environments.

"AmtOIDC": {
  "OIDC": {
    "ClientId": "amt-applicationcenter",
    "Authority": "https://login.example.org/amt-applications/v2/auth",
    "Scope": [ "openid profile amt-applicationcenter-api-scope" ],
    "ClientSecret": "c8A6L7j5E3N0n9Y",
    "TokenValidationParameters": {
      "NameClaimType": "preferred_username"
    },
    "RequireHttpsMetadata": true
  },
  ...
}

CookieAuthenticationOptions

The CookieAuthenticationOptions section contains settings for the cookie used for user authentication.

• Name - The name of the authentication cookie used to store the identity token.
• Domain - The domain of the authentication cookie.
• Path - The path of the authentication cookie.
• SameSite - The SameSite policy of the authentication cookie. Set to None if the application is used in an iframe.
  Allowed values are: Undefined (the default value, which does not set a SameSite field), None (disables SameSite restrictions), Lax (sends the cookie with same-site requests and cross-site top-level navigations), and Strict (sends the cookie only with same-site requests).

"CookieAuthenticationOptions": {
  "Cookie": {
    "Name": ".Amt.AC.Auth",
    "Domain": "",
    "Path": "/",
    "SameSite": "None"
  }
},

AmtOIDC

This section contains the remaining OpenID Connect options.

• DisableRefreshTokens - Set to true to disable token refresh. The default is false.
• RefreshThreshold - The refresh threshold in seconds, if enabled. If tokens expire within the configured threshold, they are refreshed. The default is 60 seconds.
• EnableClientAssertion - Set to true to enable client assertion. The default is false. If this is enabled, a signed token is used to authenticate users instead of a client secret.
• ClientAssertionAlgorithm - The algorithm used to sign the token for client assertion. The default is RS256.
• CertificateConfig - This section must be set if client assertion is enabled. See CertificateConfig.

"AmtOIDC": {
  ...
  "DisableRefreshTokens": false,
  "RefreshThreshold": 60,
  "EnableClientAssertion": false,
  "ClientAssertionAlgorithm": "RS256",
  "CertificateConfig": {
    ...
}

CertificateConfig

Configuration options for the certificate used to sign the client assertion. This section can be omitted if client assertion is disabled.

• AllowInvalid - Set to true to allow invalid certificates. The default is false.
• Subject - The certificate subject.
• StoreName - The name of the certificate store. The default is MY.
• StoreLocation - The location of the certificate store. The default is CurrentUser.
• Path - The path to the certificate file.
• Password - The certificate password. This is only necessary when loading the certificate from a file or from base64.

"CertificateConfig": {
  "AllowInvalid": true,
  "Subject": "amt-application-cert",
  "StoreName": "MY",
  "StoreLocation": "LocalMachine",
  "Path": "certificate.pfx",
  "Password": ""
}

DataProtection

The DataProtection setting contains options for ASP.NET Core data protection, which is used to encrypt the session state and authentication cookie, among other things. This section is optional and allows keys to be stored in a specified folder, where they are encrypted with DPAPI (Data Protection API), allowing access only to accounts from the same system. This is a replacement for the ASP.NET MachineKey.
When this section is not included in the appsettings.json file, keys are saved to the registry by default.

• ApplicationName - The application name used for data protection. Using the same application name in multiple web applications results in the sharing of their keys.
• KeyRingFolder - The local directory where data protection keys are stored.

"DataProtection": {
  "ApplicationName": "",
  "KeyRingFolder": "D:\\keyringfolder\\"
},

WebSessionState

The WebSessionState section contains optional settings for the ASP.NET Core web sessions used by the Application Center Core web application.

• IdleTimeout - The number of minutes a session remains active on the server before it is discarded. The default is 10 minutes.
• IOTimeout - The timeout in minutes for loading data from the session store. The default value is 1, which is the ASP.NET Core default and usually does not need to be changed.
• The Cookie section contains settings for the cookie used for the web session.
  • Domain - The domain of the web session cookie.
  • Path - The path of the web session cookie.
  • Name - The name of the web session cookie.

"WebSessionState": {
  "IdleTimeout": 10,
  "IOTimeout": 1,
  "Cookie": {
    "Domain": "",
    "Path": "/",
    "Name": ".Amt.AC.WebSession"
  }
}

Logging

Sets the logging levels for the various ASP.NET Core components of the web application. These settings do not need be adjusted in a normal situation.
The allowed log levels are, from most to least detailed: Trace, Debug, Information, Warning, Error, Critical and None.

"Logging": {
  "LogLevel": {
    "Default": "Information",
    "Microsoft": "Warning",
    "Microsoft.Hosting.Lifetime": "Information",
    "System.Net.Http": "Warning"
  }
},

AllowedHosts

In the AllowedHosts section, access to the web application can be restricted to specific hostnames. The value is a semicolon-delimited list of host names without port numbers. By default all hostnames are allowed by the asterisk (*) wildcard. Disallowed users will get a HTTP 400 error code (Bad Request).

"AllowedHosts": "*"